Cloud NAT: Correct Statements, Features, and Configuration
An organization is configuring Cloud NAT to allow private instances to access the internet. Which three statements about Cloud NAT are correct? (Choose three.)
Quick Answer
The correct statements about Cloud NAT are that it supports both TCP and UDP protocols, requires a default route (0.0.0.0/0) to the internet gateway, and can be configured with a manual list of NAT IP addresses. Cloud NAT functions as a regional resource that performs source network address translation for private instances lacking external IP addresses, allowing them to initiate outbound connections to the internet while remaining unreachable from outside. On the Google Professional Cloud Network Engineer exam, this topic tests your understanding of how Cloud NAT differs from assigning external IPs directly—a common trap is confusing its regional scope with a per-subnet scope, or assuming it assigns external IPs to instances. Remember that Cloud NAT is regional, not per-subnet, and it never assigns external IPs; it only translates outbound traffic for instances without them. A useful memory tip is “NAT is regional, not individual,” reinforcing that it operates at the region level and applies to all configured subnets within that region.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Cloud NAT requires that the VPC has a default route (0.0.0.0/0) to the internet gateway.
Options B, D, and E are correct. Option B: Cloud NAT requires a default route (0.0.0.0/0) pointing to the internet gateway to forward traffic. Option D: You can specify a manual list of NAT IP addresses (static external IPs) for Cloud NAT to use. Option E: Cloud NAT supports both TCP and UDP protocols for outbound connections. Option A is incorrect because Cloud NAT is configured per region, not per subnet; it applies to all subnets in the region that are enabled for NAT. Option C is incorrect because Cloud NAT does not assign external IPs to instances; it provides NAT for instances without external IPs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Cloud NAT can be configured per subnet or per region.
Why it's wrong here
Cloud NAT is regional; you specify which subnets use it, but it is not per subnet.
- ✓
Cloud NAT requires that the VPC has a default route (0.0.0.0/0) to the internet gateway.
Why this is correct
Without a default route, traffic cannot reach the internet.
- ✗
Cloud NAT automatically assigns external IP addresses to instances.
Why it's wrong here
Instances keep private IPs; NAT uses a pool of external IPs.
- ✓
Cloud NAT can be configured with a manual list of NAT IP addresses.
Why this is correct
You can assign specific static IPs to the NAT gateway.
- ✓
Cloud NAT supports both TCP and UDP protocols.
Why this is correct
Cloud NAT translates both TCP and UDP traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
This PCNE question is part of Courseiva's 961-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on PCNE
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Cloud NAT to allow instances without external IPs to access the internet. They have a managed instance group (MIG) in us-central1 with 10 instances, all using the same Cloud NAT configured with a single NAT IP address. They notice that some instances are unable to connect to a specific external API endpoint, while others can. The error on the failing instances is 'Cannot connect to host'. The NAT IP is not blacklisted by the API. The Cloud NAT gateway has default settings with a minimum port per VM of 64 and a maximum of 65536. What is the most likely cause?
medium- A.The instances are using different service accounts, and the NAT is not configured to allow all.
- B.The Cloud NAT's idle timeout is set too low, causing connections to be dropped.
- C.The external API endpoint has a rate limit that is being hit by the NAT IP.
- ✓ D.Port exhaustion is occurring; increase the number of NAT IPs or increase the minimum ports per VM.
Why D: Cloud NAT uses source network address translation (SNAT) and maps internal IPs to the NAT IP using ports. By default, Cloud NAT allocates a range of ports per VM. If the instances are making many connections, they may exhaust the allocated ports. The symptom that only some instances fail suggests that the failing instances may have run out of ephemeral ports. Option D is correct: Increase the number of NAT IP addresses or increase the minimum ports per VM.
Variation 2. Refer to the exhibit. Instances in subnet-b cannot access the internet through Cloud NAT. What is the most likely reason?
easy- A.The firewall rules in subnet-b block egress.
- B.The NAT IP address pool is exhausted.
- C.Subnet-b has overlapping subnets.
- ✓ D.Subnet-b is not included in the Cloud NAT configuration.
Why D: The Cloud NAT configuration only includes subnet-a, so subnet-b is not NATed.
Variation 3. Drag and drop the steps to configure a Cloud NAT for private instances to access the internet into the correct order.
medium- ✓ A.Create a Cloud Router in the region, then create a Cloud NAT gateway using that router, then assign static IP addresses to the NAT, then apply the NAT to the desired subnets, then test connectivity from a private instance.
- B.Create a Cloud NAT gateway first, then create a Cloud Router, then assign IP addresses, then apply to subnets, then test connectivity.
- C.Create a Cloud Router, then assign IP addresses to the NAT, then create the Cloud NAT, then apply to subnets, then test.
- D.Create a Cloud Router, then create a Cloud NAT and apply it to subnets, then assign IP addresses, then test connectivity.
Why A: Cloud NAT requires a Cloud Router first. Then create NAT, assign IPs, and apply to subnets. Testing confirms internet access.
Variation 4. A company wants to provide internet access to their Compute Engine instances without assigning external IP addresses. Which Google Cloud service should they use?
easy- ✓ A.Cloud NAT
- B.Cloud VPN
- C.Private Google Access
- D.VPC Peering
Why A: Cloud NAT allows instances without external IPs to access the internet. Other options are for different purposes.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This PCNE practice question is part of Courseiva's free Google Cloud certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PCNE exam.